CVE-2026-92692
MediumCVSS 6.9Exploitation Probability (EPSS)
Low risk24th percentile - higher than 24% of all known CVEs
Summary
Sulu is an open-source PHP content management system based on the Symfony framework. Prior to 2.6.25 and 3.0.8, the affected Sulu 2.6 and 3.0 release lines have a Smart Content QueryBuilder in src/Sulu/Component/Content/SmartContent/QueryBuilder.php that concatenates category identifiers from the public categories query parameter into a JCR-SQL2 WHERE clause without numeric validation. On a public page containing a category-filtered Smart Content block, an unauthenticated attacker can alter query conditions to infer or enumerate content-repository nodes, including unpublished content, or submit malformed and expensive query fragments that degrade availability; this path does not modify repository data. This issue is fixed in versions 2.6.25 and 3.0.8.
Risk Assessment
An unauthenticated attacker can access unpublished content or cause a denial-of-service through expensive queries, potentially leading to information disclosure or disruption of service availability. This affects the confidentiality and availability of the system.
Recommendation
Update Sulu to version 2.6.25 or 3.0.8 (or later), which contains the fix for this vulnerability. If updating is not possible, consider restricting access to public pages with category filtering or monitoring for unusual queries.
Other vulnerabilities in Sulu
See all- CVE-2026-82396Medium
Sulu, a PHP content management system, before versions 2.6.25 and 3.0.8 allows an attacker with media upload permission to store HTML, XHTML, or XML documents and create links with inline=1, causing the application to return the file without Content-Disposition attachment. Opening such a link by an authenticated user allows execution of malicious JavaScript in the context of the victim's session on the Sulu origin.
- CVE-2026-82395Medium
Sulu before versions 2.6.25 and 3.0.8 has a vulnerability in the media move endpoint where the permission check is based on the client-supplied collection value rather than the actual source collection. An authenticated backend user with edit permission in one collection can move an item out of a restricted collection and then view or download content they are not permitted to access.
- CVE-2026-82394Medium
Sulu before versions 2.6.25 and 3.0.8 does not enforce VIEW permission for target resources in the preview-link endpoint. An authenticated administrative user who knows a resource identifier can create or revoke a preview link for any page, article, or snippet, including content they cannot view. The generated preview URL is public and allows reading restricted content without authentication.
- CVE-2026-45701Medium
Sulu, an open-source PHP CMS based on Symfony, before versions 2.6.23 and 3.0.6 uses a weak cryptographic hash algorithm for password reset token and API key generation.
- CVE-2026-34372Low
In Sulu, an open-source PHP CMS based on Symfony, versions 1.0.0 through 2.6.22 and 3.0.0 through 3.0.5, a user with permission for the Sulu Admin via at least one role could access sub-entities of contacts via the admin API without having permission for contacts.
Original NVD description (English source)
Sulu is an open-source PHP content management system based on the Symfony framework. Prior to 2.6.25 and 3.0.8, the affected Sulu 2.6 and 3.0 release lines have a Smart Content QueryBuilder in src/Sulu/Component/Content/SmartContent/QueryBuilder.php that concatenates category identifiers from the public categories query parameter into a JCR-SQL2 WHERE clause without numeric validation. On a public page containing a category-filtered Smart Content block, an unauthenticated attacker can alter query conditions to infer or enumerate content-repository nodes, including unpublished content, or submit malformed and expensive query fragments that degrade availability; this path does not modify repository data. This issue is fixed in versions 2.6.25 and 3.0.8.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS